Auth bypass in @Nuxt Nitro-Server
CVE-2026-119200
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3.
Published .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- @Nuxt Nitro-Server — versions >= 4.6.0, < 4.6.3
- Nuxt — versions >= 4.6.0, < 4.6.3
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-119200?
- CVE-2026-119200 is a medium-severity vulnerability in @Nuxt Nitro-Server, classified under CWE-41. CVSS score: 6.5/10. Published 2026-10-29.
- How severe is CVE-2026-119200?
- Medium severity. CVSS v3 base score is 6.5 out of 10.